Copilot in the Real World: How to Make Your AI Investment Actually Deliver ROI

Enterprise enthusiasm for deploying Microsoft Copilot has never been higher — yet organizations that can actually prove a return on that investment remain few and far between. Stephen Rose, a 15-year Microsoft veteran and current CTO of Envision Technologies, shared a sobering reality backed by extensive client case studies: in year one, only about 30% of AI projects clear a recognizable ROI threshold. The culprit, more often than not, isn't the tool itself — it's how prepared the organization is.

First, Run the Numbers: What's the ROI Bar for Copilot?

Rose offered a set of figures every IT decision-maker should keep front of mind. A typical Fortune 500 company with 5,000 employees spends roughly $1.8 million per year on Copilot — that's about 360 hours of usage cost per employee annually.

The challenge: for an IT project to be deemed "successful," it typically needs to deliver 20% ROI annually, growing 10–20% each successive year over three years. Do the math, and the organization must be able to demonstrate roughly $350,000 in real, tangible returns from Copilot and AI each year.

"When you go to your boss, you need to be able to say: we spent this much — what did we get?" Rose emphasized. The answer has to be concrete. Think of tools in the admin center that compress a task from 34 hours a week down to 4 — that kind of quantifiable time savings is what actually makes the case.

Stop Paying Separately for ChatGPT and Claude

One of the most common mistakes Rose observes is enterprises that already have Copilot still purchasing separate ChatGPT and Claude subscriptions for employees. This isn't just redundant spending — it introduces serious security risks.

He pointed out multiple shortcomings with these third-party tools: no native enterprise context (no Microsoft Graph connection), separate API maintenance required to connect to Office, and limited security controls. More critically, GPT Plus or Pro offers no data residency guarantees, data may be retained for model training, and there's no Purview-integrated DLP, no audit logs, and no SSO support.

Achieving enterprise-grade security requires upgrading to ChatGPT Enterprise at $100 per user — and Claude can't even match that capability, making it even more expensive for organizations with data privacy requirements. "So you're not actually saving money, and you're not making life easier," Rose concluded. The answer is to retire those redundant subscriptions, teach employees to use Copilot properly, and accomplish both cost savings and data governance in one move.

Microsoft Graph is the core data layer of the Microsoft 365 ecosystem. It indexes a user's emails, calendar, files, Teams conversations, contacts, and other enterprise data — and exposes that information to authorized applications. Copilot derives its enterprise context through Graph. That's why it can understand a reference like "the contract I discussed with the VP last week" — Graph has already mapped those relationships. Third-party LLMs like ChatGPT and Claude don't have this connection by default; accessing it requires additional API integrations that typically move data outside Microsoft's security perimeter to external servers. Microsoft Purview is Microsoft's information protection and compliance platform, providing data classification labels, data loss prevention (DLP), audit logs, and more. Without Purview integration, organizations have no way to track which sensitive data has been processed by AI — and no complete operational record to present during compliance reviews.

The Real Question Isn't "Is Copilot Secure?"

Rose shared a question from a client that he found genuinely illuminating. When asked "Is Copilot secure?", the right framing is actually: "Is our environment secure enough to grant AI such powerful access to find, synthesize, and act on our information?"

In other words, the security focus needs to shift from the tool to the organization's own infrastructure. Are you using data sensitivity labels? When someone shares a confidential-labeled file in a meeting, are participants without proper permissions correctly blocked? Auditing your own governance framework is the prerequisite work that must happen before deploying AI.

The 15-70-15 Rule: Put Your Energy Where It Counts

On the topic of change management, Rose introduced what he calls the "15-70-15" rule. Roll out any change to 1,000 employees and you'll reliably see three groups emerge: 15% who are enthusiastic early adopters ready to sign up immediately, 15% who are diehard resisters ("I'll never change"), and 70% in the middle who are watching and waiting.

His advice is blunt: invest almost nothing in the 30% at either extreme. Making already-happy people happier yields little. Trying to convert the diehards is exhausting. The real leverage is with the middle 70% — reach them through surveys, engage team leads, and cultivate "change champions" who can bring them along.

Rose recommends identifying at least two people from each job function to develop as subject matter experts, creating a pyramid of peer support. The key advantage: when someone says "my job can't do this," a change champion from that same role can respond: "Actually, you can — because I do the same job you do."

One sobering statistic to keep in mind: 44% of employees don't understand why a change is being made. This reinforces a point Rose returned to repeatedly — leadership must clearly communicate the "why." Without it, employees will fill the vacuum with their own assumptions, most often: "They're going to use AI to replace me."

The Uber Lesson: Blindly Replacing People with AI Burns More Money

To illustrate the dangers of poor planning, Rose cited a cautionary tale. As he described it, Uber laid off three-quarters of its developers under the assumption that AI could cover their work — and burned through $60 million in token costs within 90 days. "They didn't save money. They spent more."

This case reinforces his core argument: successful AI deployment requires defining what success looks like upfront. Just as assembling a jigsaw puzzle requires seeing the picture on the box, organizations that push forward without clear goals and measurement frameworks will find their "AI adoption" amounts to little more than a slogan.

Data Quality: The One Slide That Decides Everything

Rose was direct: if he could keep only one slide, it would be the one about data quality. He walked through a litany of painfully familiar enterprise patterns — employees downloading local copies from SharePoint and Teams, sending files as email attachments instead of sharing links, storing shared files in OneDrive instead of Teams, keeping documents that are a decade old. He even encountered a company that had crammed every single file in the organization into a single SharePoint folder.

When six or more versions of the same file exist across the network, ask Copilot "which one is the real version?" — and it will tell you: "I don't know."

The solution is managing ROT: Redundant, Outdated, and Trivial content. Feed Copilot a diet of duplicated and expired data and you'll get poor answers. Clean it down to relevant content, pair it with proper prompt training, and the quality of responses improves dramatically. Rose was candid: most of the organizations he works with haven't reached this stage yet.

Concrete Rules for Data Archiving

Rose offered a directly actionable archiving standard: archive emails older than 12–18 months; for documents older than three years that haven't been accessed in the past 90 days, move them to Azure cool or hot storage. His rationale: 80% of work revolves around documents created or used within the past 90 days.

The economics are compelling. Azure cool storage runs roughly $0.02 per GB, compared to $2.00 for standard storage. For an organization with 3.2 TB of data that can migrate 1.5 TB out, that's roughly $40,000 in annual savings — another concrete, defensible line of ROI.

ROT is a classic information governance framework standing for Redundant, Outdated, and Trivial data — three categories of problematic content. The concept was pioneered by information management expert Jill Tillman as a way to assess the health of an organization's digital assets. In the AI era, ROT problems are dramatically amplified. A traditional search tool that surfaces the wrong file still leaves a human to apply judgment. But large language models synthesize and generate based on all input data — they have no mechanism to independently assess data trustworthiness, and can only respond based on the overall distribution of what they've been fed. Six co-existing versions of a file represent genuine "conflicting signals" to Copilot, and output quality degrades in direct proportion to the noise ratio in the dataset. This is why the data preparation phase of an AI deployment is fundamentally a mandatory information governance initiative — not simply a technical configuration exercise.

Using Scout to Keep Up with 316 Feature Updates

The final challenge is keeping pace with Copilot's update velocity. Rose revealed that between June 2025 and May 2026, Copilot added 316 new features. Manual tracking simply isn't feasible.

His approach: run two Scout automation tasks. One pulls the Microsoft Roadmap daily, tracking when features reach GA (General Availability) and when they reach GCC (Government Community Cloud), auto-grouping them by category — features, security, end-user capabilities — and writing results into a Loop workbook. The second monitors "What's New" updates across Teams, Copilot, Microsoft 365, and Microsoft Security.

Each run costs roughly $3 in token fees. Rose then has Copilot prioritize those updates based on the company's actual business context, flagging the most important items, which are then distributed to team sites. This shifts IT from reactive to proactive — the support team can look up whether any given feature is in GA, preview, or GCC at any moment, creating a living document that stays current.

The Scout mentioned here is a workflow built on Microsoft 365 Copilot's automation agent (Agent) functionality — not a standalone third-party application. It uses Copilot's "agent mode" to periodically scrape specified web content, parse structured information, and write it into a Loop workbook. In essence, it's a low-code RPA (robotic process automation) implementation. GA (General Availability) and GCC (Government Community Cloud) represent two primary Microsoft feature release channels: GA pushes to commercial cloud tenants broadly; GCC is an isolated cloud environment designed specifically for U.S. government agencies and their contractors, subject to stricter data sovereignty and compliance requirements — feature updates typically lag the commercial cloud by weeks to months. For organizations serving government clients, distinguishing between the two rollout timelines is a very practical operational need.

Closing Thoughts

Rose's message was clear: Copilot ROI isn't built by buying more licenses. It's earned through cleaning up data, managing change deliberately, investing with precision, and tracking outcomes continuously. The tool is just the starting point. The organization's own governance maturity is the variable that determines success or failure. For any organization that is deploying — or preparing to deploy — AI, asking "are we actually ready for this?" matters far more than rushing to go live.